EUDR audit checklist: the evidence to produce

In brief

• In France, the competent authority for the RDUE (the European regulation on deforestation and forest degradation, the French name for the EUDR) is a joint one: the ministry responsible for the Ecological Transition and the ministry responsible for Agriculture.
• EUDR inspections are risk-based and mainly documentary: they cover the DDS (due diligence statement, Due Diligence Statement) and the information that underpins it.
• Seven evidence themes are enough to structure a file: product scope, geolocation, legality, risk assessment, submitted DDS, internal procedures, training.
• Evidence must be linked to batches and kept over time (at least five years under the regulation) - not just at the date of placing on the market.
• A common weakness: evidence that is held but not consolidated, not versioned, or scattered across emails, spreadsheets and local folders.
• A 30-day plan turns compliance that is “real but not demonstrable” into a presentable file.

Who inspects your EUDR compliance, and when?

Short answer: a government department designated as competent authority, on the basis of a risk analysis, and at several points in a product’s life - not only during a formal inspection. Three triggers coexist: public inspection, customer audit and certification audit.

The competent authorities in France

Member States designate one or more competent authorities responsible for checking the operators and traders established on their territory, as well as the products placed on the market, made available or exported.

In France, the competent authority is a joint one: the ministry responsible for the Ecological Transition and the ministry responsible for Agriculture. Customs (DGDDI) handle the formalities and checks linked to border crossings, not the substantive review of the due diligence file. The DGCCRF should not be presented as the designated EUDR authority: for the content of the obligations, the official contacts are the two ministries above.

Documentary checks: what triggers a request

The regulation sets a minimum level of annual checks, adjusted according to the level of risk:

These figures are minimums: an authority may check more. Checks may cover, in particular, the DDS and the information supporting it, the company’s procedures and risk assessments, traceability back to the plots of production, and - where necessary - on-the-spot checks or audits.

How this fits with customer and certification audits

Your EUDR compliance will also be examined outside public inspections, in two settings:

• Customer / supplier audits: buyers are increasingly including contractual clauses on regulatory compliance, traceability and documentation. Requests often arrive as questionnaires, document lists or corrective action plans.
• GFSI certification audits: the GFSI (Global Food Safety Initiative) is a coalition that recognises food safety standards (IFS, BRCGS, FSSC 22000, etc.). The GFSI neither audits nor certifies itself: independent bodies audit the company against the recognised standard. These standards assess document control, traceability and regulatory compliance - requirements that largely overlap with an EUDR file. To prepare this aspect, see which GFSI certification to choose.

Three moments when you will be asked for evidence

1. Public inspection (risk analysis, investigation, request for documents).
2. Customer audit (qualification, supplier audit, annual review).
3. Certification audit and its follow-up (management review, non-conformities, action plan).

A single, properly structured evidence file serves all three. A file pieced together in a rush only serves once - and badly.

“The operators shall document and review the risk assessments at least on an annual basis and make them available to the competent authorities upon request.”Regulation (EU) 2023/1115, Article 10(4) · consolidated text, EUR-Lex

The evidence to produce, by theme

Evidence is always read “in cascade”: every claim must be traceable to a source document. Here are the seven themes to cover in your EUDR audit checklist.

Theme 1 - Product scope and role in the chain

The aim is to demonstrate which products fall within the scope of the regulation (relevant commodities and derived products listed in Annex I, derived in particular from cattle, cocoa, coffee, oil palm, rubber, soya and wood), and what role you play: operator, trader or other actor.

Expected evidence:

• mapping of products and their codes (Combined Nomenclature / HS);
• documented decision: in scope / out of scope, with justification;
• description of your position in the chain (importer, first to place on the market, processor, distributor);
• production volumes and units (batch, production order, period).

Theme 2 - Geolocation of plots

This is the most technical and most scrutinised theme. Geolocation must make it possible to link a product to identified plots of land, with usable coordinates.

Expected evidence:

• plot database with coordinates (polygons above the 4-hectare threshold, a point otherwise);
• file format and coordinate system used;
• linking key plot → supplier → material → batch;
• version history (a plot may be re-measured, renamed or replaced).

Theme 3 - Legality of production

It is not enough for the product to be “deforestation-free”: it must have been produced in accordance with the relevant legislation of the country of production. Legality is not inferred, it is documented.

Expected evidence:

• list of the relevant legal requirements identified by country/area;
• supporting documents: permits, land titles or use rights, taxation, social and environmental obligations depending on the country;
• signed supplier declarations, contractual commitments;
• references of the certifications or third-party assessments relied on.

Theme 4 - Risk assessment and mitigation

The regulation is based on due diligence: collect the information, assess the risk of non-compliance, then mitigate any non-negligible risk. The auditor will look at the method and how it is applied, not just the conclusion.

Expected evidence:

• documented risk grid (origin, complexity of the chain, risk of mixing, risk of fraud);
• risk level assigned by origin and by supplier;
• mitigation measures implemented (additional data, verifications, audits, action plans);
• decision to place on the market or to block, and its justification.

Theme 5 - Submitted DDS

The DDS (due diligence statement) is the central document in the chain of responsibility: it is submitted to the EU information system (accessible via TRACES) before placing on the market or exporting, according to the rules applicable to the actor and the product. To prepare this aspect, see our guide EUDR DDS: content, submission and retention.

Expected evidence:

• register of submitted DDS: reference, date, product, quantity, origin;
• upstream DDS reused (references of your suppliers’ statements);
• proof that references were sent / shared with downstream partners;
• consistency between DDS, batches and invoiced volumes.

Theme 6 - Internal procedures

Compliance without a procedure is compliance that does not survive the departure of the person who carries it.

Expected evidence:

• due diligence procedure (who does what, when, with which data);
• procedure for managing deviations and non-conformities, with handling and follow-up. See managing non-conformities in the food industry;
• document management procedure (naming, versioning, archiving, access). See managing regulatory documents;
• internal audit or periodic review of the system, with evidence that it was carried out.

Theme 7 - Training and awareness

The auditor wants to know whether key people know what they are doing and why.

Expected evidence:

• matrix of exposed roles (Purchasing, Quality, SQA - Supplier Quality Assurance - , Regulatory, Supply Chain);
• training materials and dated attendance sheets;
• proof of understanding: quizzes, workshop minutes, questions addressed.

Summary table - evidence / format / owner

Expected format and level of detail for each piece of evidence

Evidence usable in an audit meets four criteria: identifiable, dated, sourced and linked to a product or batch.

Rule of thumb: for each piece of evidence, an external reader should be able to trace it back to the source in two clicks and understand the decision taken without calling you.

Organising a versioned evidence binder linked to batches

Content matters, but the way it is filed determines how fast you can respond - and how credible you are. An EUDR evidence binder is built around three requirements: traceability, versioning and linking to batches.

Naming rule

Adopt a single convention, such as:

THEME_PRODUCT_SUPPLIER_DATE_VERSION.status

Example: LEGALITY_COFFEE_COOP-X_2026-09-15_v2.validated

An explicit convention avoids document_final_final_v3.pdf and enables sorting, searching and cross-checking.

Linking to batches

The binder must make it possible to answer the question: “For this shipped batch, what was the evidence?” Three linking keys are usually enough:

• batch / production order: internal production or shipment identifier;
• material: material code and upstream supplier;
• plot: identifier of the plot or group of plots.

This triple key is where most systems break down: the evidence exists, but no link to the batch is documented. To structure it in your systems, see EUDR and supplier data in the ERP.

Versioning and history

• current version clearly identified, earlier versions kept;
• change log (date, author, reason);
• no silent overwriting of a validated document.

Access and control

• differentiated rights (read / write / approve);
• backup and business continuity plan;
• export possible in the event of an inspection, even without access to the usual tool.

The 10 questions an auditor will actually ask

These questions come up every time, whatever the setting (authority, customer, certification body).

1. Which products in your catalogue fall within the scope of the regulation, and how did you establish this?
2. Who is your tier-1 supplier, and who is behind them all the way back to the plot?
3. Where are the plot coordinates stored, and in what format?
4. How do you obtain proof of legality of production, country by country?
5. What is your risk assessment method, and who approves it?
6. What measures did you take when a non-negligible risk was identified?
7. How many DDS have you submitted, for which products, and where are the references?
8. How do you link a DDS to a shipped batch?
9. How long do you keep the files, and where?
10. What happens if a supplier does not provide the data requested?

Prepare a short, sourced answer for each. An answer such as “we are going to put it in place” is read as a non-conformity, not as a plan.

The most common weak points

1. A DDS submitted without a supporting file: the statement exists, but the information that justifies it has not been consolidated.
2. Upstream traceability breaks: traders, pooled purchasing and mixing leave the plot → batch link incomplete.
3. Approximate geolocation: coordinates missing, out of date or without a linking key.
4. Assumed legality: the product is deemed legal because the supplier is “trusted”, with no named supporting document.
5. Scattered evidence: emails, local spreadsheets, duplicated folders, contradictory versions.
6. No evidence of decisions: nobody can say who approved what, or on what basis.
7. Compliance that is not kept up to date: the evidence dates from the initial set-up and has not kept pace with changes in suppliers or scope.
8. A system carried by a single person: with no procedure or record, that person’s departure creates a compliance gap.

30-day preparation plan

This plan assumes real compliance, even if partial. Objective: make it demonstrable.

Tip: the D23-D27 test is the most useful step. A file that has never been questioned almost always hides a break in the chain.

Final checklist to tick off

• Product scope
• List of in-scope products, with codes and volumes
• Applicability decision documented and dated
• Role in the chain identified (operator / trader)

• Geolocation
• Plot database with usable coordinates
• Linking key plot → supplier → material → batch
• Version history kept

• Legality
• Relevant legal requirements listed by country
• Named, dated supporting documents, issuer identified
• Signed supplier declarations

• Risk
• Assessment grid documented and applied
• Mitigation measures recorded for any non-negligible risk
• Evidence of the decision to place on the market or to block

• DDS
• Register of submitted DDS (reference, date, product, quantity, origin)
• Upstream DDS referenced
• DDS / batches / volumes consistency checked

• Procedures and training
• Versioned due diligence procedure
• Document management and non-conformity procedure
• Role matrix and training evidence

• Binder
• Naming convention applied
• Triple linking key operational
• Access rights defined and backup tested

From compliance to a demonstrable file

The real difficulty is not carrying out due diligence, but being able to prove it when you are asked, for the right batch, with the right version of the right document. It is as much a problem of centralising and circulating information as one of compliance: the useful data arrives in documents (declarations, certificates, data sheets, coordinates, statements) and must be linked to suppliers, products and batches.